Skip to content

Fix pointer arguments in addFunction + wasm64 #24693

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

RReverser
Copy link
Collaborator

@RReverser RReverser commented Jul 13, 2025

Without this fix, any usages of addFunction with pointers in signatures would add broken functions to the webassembly table, which would fail with errors like "Cannot mix BigInt and other types, use explicit conversions" when invoked.

To fix this, we need to do essentially the opposite of what we do in dynCall and convert all pointer arguments to numbers before invoking the actual JS function, and the pointer result to bigint before returning to wasm.

@RReverser RReverser requested review from kripken and sbc100 July 13, 2025 01:27
Without this fix, any usages of addFunction  - e.g. dylink - would add broken functions to the webassembly table, which result in errors like "Cannot mix BigInt and other types, use explicit conversions" when invoked.

To fix this, we need to do essentially the opposite of what we do in `dynCall` and convert all pointer arguments to numbers before invoking the actual JS function, and the pointer result to bigint before returning to wasm.
@RReverser RReverser force-pushed the add-function-p-wasm64 branch from e08b2bd to 3d8535f Compare July 13, 2025 12:07
}
''')

self.do_runf('main.c', '')
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm a little surprised we don't have any existing tests of addFunction being used with JS functions with 'p' in their signatures.

I'd like to take a moment to try and figure out why no existing test covered this.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, as long as it doesn't block the fix too long.

Copy link
Collaborator Author

@RReverser RReverser Jul 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suspect it's possible that even if there were any tests, they 1) weren't doing pointer arithmetic and 2) weren't returning a pointer from JS to Wasm, only the other way around.

Without these conditions, e.g. if you have a simple tests that only logs the passed argument, the issues wouldn't trigger.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just a little suprised we don't run into this issue with our exist dynamic linking tests. The main user or addFunction for JS function with a signature passed are in dynamic linking, firstly in dlsym and secondly (which I imagine occurs way more often) in reportUndefinedSymbols which will fill in missing GOT entries using JS functions. I'm surprised we don't run into this there.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh wait.. I think its because JS libraries functions are modified in place when they are constructed, right? So this change is not necessary for JS library functions at all, only for JS functions that come from elsewhere?

Is that right?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All library JS functions are modified here:

emscripten/src/jsifier.mjs

Lines 267 to 277 in b490c44

function handleI64Signatures(symbol, snippet, sig, i53abi) {
// Handle i64 parameters and return values.
//
// When WASM_BIGINT is enabled these arrive as BigInt values which we
// convert to int53 JS numbers. If necessary, we also convert the return
// value back into a BigInt.
//
// When WASM_BIGINT is not enabled we receive i64 values as a pair of i32
// numbers which is converted to single int53 number. In necessary, we also
// split the return value into a pair of i32 numbers.
return modifyJSFunction(snippet, (args, body, async_, oneliner) => {

So (IIUC) this change is not necessary for JS library functions, in fact its somewhat detrimental in that case.

Copy link
Collaborator Author

@RReverser RReverser Jul 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for example I think EM_JS/EM_ASM has no way to deal with this today and you need to modify your code to handle wasm64

Right, but the way it was discussed in the past gave me an impression it's considered a bug / a limitation of the current system rather than desired outcome? UPD: I think it's also only EM_JS, EM_ASM has a way to determine pointers.

How many folks are calling addFunction directly? Let along with a the sig argument set. Did you run into this issue because you are doing this?

Yeah. I can work around it manually, but contributing a fix to the addFunction itself seemed like the better choice since it will likely affect other users too when they add wasm64 support.

Doing things like ptr + length is certainly not uncommon, and any such code would break if it ends up in addFunction (eg via dylink) + compiled for wasm64.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that the function is wrapped only if it has p somewhere in its signature.

So if you say JS library functions get p converted to i/j statically, then they should be skipped from the wrapping anyway.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So which functions are effected then? i.e. how did you come across this bug? Are you trying trying to add non-js-library functions manually using addFunction with manual signature agument specified?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So if you say JS library functions get p converted to i/j statically, then they should be skipped from the wrapping anyway.

I don't think the current wrapping process modifies that .sig property of the function to remove the p elements. Perhaps if it did that would alleviate that concern about double wrapping. (But we would need to be sure that we don't need to process those p values elsewhere at runtime too).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants